Changeset 63077 for branches/6.9/src/wp-includes/user.php

Timestamp:

08/06/2026 05:32:00 PM (7 weeks ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 6.9 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• EmojI: Ensure that the emoji settings come from a script element.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Comments: Exclude notes from comment feed queries.
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output of Post Date.
• Editor: Ensure Content block tags always match available options.

Merges [63059],[63060],[63061],[63062],[63063],[63064],[63065],[63067],[62804] to the 6.9 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, jonsurrell, davidbinda, johnbillion, ehtis, batmoo, lancewillett, wildworks, mukesh27, odkdn1, khokansardar, isabel_brison, bernhard-reiter, tyxla, aduth, talldanwp.

Location:

branches/6.9

Files:

• . (modified) (1 prop)
• src/wp-includes/user.php (modified) (9 diffs)

branches/6.9/src/wp-includes/user.php

@@ -187 +187 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error:</strong> The username <strong>%s</strong> is not registered on this site. If you are unsure of your username, try your email address instead.' ),
-                                $username
+                                esc_html( $username )
                         )
                 );
@@ -214 +214 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error:</strong> The password you entered for the username %s is incorrect.' ),
-                                '<strong>' . $username . '</strong>'
+                                '<strong>' . esc_html( $username ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -297 +297 @@
                                 /* translators: %s: Email address. */
                                 __( '<strong>Error:</strong> The password you entered for the email address %s is incorrect.' ),
-                                '<strong>' . $email . '</strong>'
+                                '<strong>' . esc_html( $email ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -3529 +3529 @@
                                 /* translators: %s: Link to the login page. */
                                 __( '<strong>Error:</strong> This email address is already registered. <a href="%s">Log in</a> with this address or choose another one.' ),
-                                wp_login_url()
+                                esc_url( wp_login_url() )
                         )
                 );
@@ -3577 +3577 @@
                                 /* translators: %s: Admin email address. */
                                 __( '<strong>Error:</strong> Could not register you&hellip; please contact the <a href="mailto:%s">site admin</a>!' ),
-                                get_option( 'admin_email' )
+                                esc_attr( get_option( 'admin_email' ) )
                         )
                 );
@@ -3800 +3800 @@
  * @since 3.0.0
  * @since 4.9.0 This function was moved from wp-admin/includes/ms.php so it's no longer Multisite specific.
+ * @since 7.0.3 Added the `$user_id` parameter, which is sent with the `personal_options_update` action.
+ *
+ * @param int $user_id Optional. The ID of the user whose email is being changed. Defaults to `$_POST['user_id']` if set, otherwise 0.
  *
  * @global WP_Error $errors WP_Error object.
  */
-function send_confirmation_on_profile_email() {
+function send_confirmation_on_profile_email( $user_id = 0 ) {
         global $errors;
+
+        // Maintain backward compatibility for those relying on a check based on $_POST['user_id'].
+        if ( ! $user_id && isset( $_POST['user_id'] ) ) {
+                $user_id = absint( $_POST['user_id'] );
+        }
 
         $current_user = wp_get_current_user();
@@ -3811 +3819 @@
         }
 
-        if ( $current_user->ID !== (int) $_POST['user_id'] ) {
+        if ( 0 === $current_user->ID || $current_user->ID !== (int) $user_id ) {
                 return false;
         }
@@ -3825 +3833 @@
                         );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }
@@ -3838 +3847 @@
                         delete_user_meta( $current_user->ID, '_new_email' );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }